LANDOWNER PRIVACY NOTICE 


Iberdrola, S.A. has developed a tool to manage its relations with suppliers or those interested in 
participating in tenders for the award of contracts with Iberdrola S.A., or any of the companies 
of the Iberdrola Group in accordance with commercial legislation. This tool (hereinafter, 
indistinctly, the "Portal" or the "Register of Potential Suppliers and Suppliers" or "Register") is 
managed by Iberdrola S.A. and the information contained at all times during its dialogue with 
third parties (interested suppliers, approved suppliers, contracted suppliers and, in the case of 
legal entities, their representatives and contact persons) is accessible to all these companies, 
some of which are outside the European Economic Area. The list of these companies is accessible 
through 

https://www.iberdrola.com/wcorp/gc/prod/es_ ES/corporativos/docs/IB_Informe Financiero 


Anual.pdf 


Therefore, for the purposes of the regulations on personal data protection, we inform you that 
any information about suppliers or potential suppliers (and, in the case of legal entities, their 
representatives and contact persons) obtained as a result of an application for registration in 
this Portal or any preliminary treatment or initiative with Iberdrola S.A or any of the companies 
of the Iberdrola Group to qualify as a supplier, involves the incorporation of such information in 
the Portal and its consequent access and knowledge by any of the expressed companies 
belonging to the Iberdrola Group. 


Iberdrola, S.A and the companies that form part of the Iberdrola Group in accordance with 
commercial legislation (hereinafter, any of them, "Iberdrola") are committed to protecting your 
privacy and guarantee compliance with personal data protection legislation, in particular, the 
General Data Protection Regulations ("GDPR") and the Organic Law on the Protection of 
Personal Data and Guarantee of Digital Rights ("LOPDGDD"). Your personal data will be 
processed in a lawful, loyal and transparent manner; in accordance with specific, explicit and 
legitimate purposes; only if it is appropriate, relevant and limited to what is necessary in relation 
to those purposes. In addition, we will keep your data accurate and up-to-date, keeping it in a 
form that allows it to be identified only for as long as is necessary to fulfil the purposes of the 
processing. 


Iberdrola has implemented the necessary technical and organisational measures to protect your 
data from accidental loss or from unauthorised alteration, access, use or disclosure and has also 
established procedures to react to any security incident that could affect your personal data. 


By means of this Privacy Policy we inform you about the treatment of the personal data the 
personal data of a Supplier (or, in the case of legal entities, their representatives and contact 
persons) while remains registered in the Register and, if applicable, during the contractual 
relationship with Iberdrola. 


In the case of updating this privacy notice we will inform you through the Iberdrola website in a 
timely manner. 


In the event that, as a result of your contractual relationship with Iberdrola, you provide us with 
details of third parties, such as names, positions and contact details of your employees, 
directors, shareholders or representatives, you must, prior to providing us with such details, 
inform such third parties of the processing of such details in the terms set out in this Privacy 
Policy. 


Who is responsible for processing your personal data? 


The data controller of your data is (i) the company of the Iberdrola Group with which you have 
a contractual relationship and whose data appear in the contractual documentation and (ii) 
Iberdrola S.A., with registered office at Plaza Euskadi 5, 48009 Bilbao, Spain as holder of the 
Register of Potential Suppliers and Suppliers of the Iberdrola Group and provider of purchasing 
services to all companies of that business group. 


Likewise, any of the companies of the Iberdrola Group is or may become responsible for the 
processing of the data to the extent that (i) the information incorporated in the Portal of 
Suppliers and Potential Suppliers is produced through the same or (ii) said companies access the 
content of the Portal. 

The companies of the Iberdrola Group have appointed Data Protection Officers, who may be 
contacted at the e-mail addresses indicated below, where applicable: 


- Iberdrola, S.A.: dpo@iberdrola.com 
- Rest of the Iberdrola Group companies in Spain: dpo@iberdrola.es 


- Iberdrola Energia Internacional, S.A.U., Iberdrola Clientes Internacional, S.A.U. and 
Iberdrola Renovables Internacional, S.A.U.: dpoiei@iberdrola.com 

- Iberdrola Group companies in UK: dataprotection corporate@scottishpower.com 

- Iberdrola Group companies in Italy: dpo@iberdrola.it 

- Iberdrola Group companies in Portugal: dpo@iberdrola.pt 

- Iberdrola Group companies in Ireland: dataprotection@iberdrola.ie 

- Iberdrola Group companies in France: dpo@iberdrola.fr 


- Iberdrola Group companies in Germany: datenschutz @iberdrola.de 
- Iberdrola Group companies in Brazil: doo@neoenergia.com 


What personal data do we collect and process from you? 


Iberdrola shall only process your personal data that is necessary to fulfill the processing purposes 
informed below. The personal data that we may process about you are: 

e Name, surname(s), DNI/NIF/NIE, passport, postal address, fixed/mobile phone number, 
e-mail, image and signature. In the case of the contact person, also his or her e-mail 
address, for the purposes of the double authentication factor detailed in the section on 
the purposes of processing; 

e Activity; and 

e Bank details for transfers and payments. 

Iberdrola may ask you to provide the original documentation and a copy of it as evidence to 
support the information you have provided. 


How do we collect your personal data? 
You provide us with your personal data through the information that you provide to us during 
the contracting process and during the contractual relationship with you or with the legal entity 


you represent or acts as contact person. 


If you do not provide us with the personal data requested, we may not be able to proceed with 
the contractual relationship, with our legal obligations and manage our activity. 


We ask you to update your personal data as they change, and always provide accurate 
information, as we must have your current information. 


For what purposes do we process your data? 
The information you provide will be treated according to the following purposes: 


a) Maintenance, development and control of the contractual relationship 

b) Internal management of suppliers 

c) Preparation of surveys and statistics and internal reports. 

d) Management of collections and payments 

e) Administrative management 

f) Submission of tax information 

g) Management of administrative and judicial procedures and actions with public bodies related 
to this matter. 

h) In the case of the e-mail of the contact person with the Iberdrola Group, to apply a double 
authentication factor consisting of adding a second method of user verification. 

i) To have the background of the contracts made by Iberdrola with the supplier, for the purpose 
of considering it as a criterion in future contracts. 

j) Managing the coordination of business activities and the prevention of occupational hazards 
of contractors and health and safety, where applicable. 

k) Management of complaints and queries in the supplier's ethical channel, analysis of possible 
conflicts of interest and analysis of solvency, anti-corruption, fraud or related risks. 


In relation to the purpose indicated in section k), specifically in relation to risk analysis, we 
hereby inform you that personal data of individuals (attorneys-in-fact, directors or shareholders) 
linked to the Iberdrola Group company supplier, legitimately obtained from public records or 
from certain companies such as Refinitiv or Dow Jones, may be used to carry out these analyses 
(company privacy notices linked below): 
https://www.refinitiv.com/en/products/world-check-kyc-screening/privacy-statement 





The Supplier agree to inform such persons in accordance with this privacy notice, keeping the 
Iberdrola Group company with which you have a contractual relationship harmless from any 
damages that may result from failure to comply with this obligation. 


What is the legal basis for the data processing? 


The legal basis for the processing of your data for the purposes indicated in paragraphs a) and 
d) above is the execution of the contractual relationship. 


The legal basis for the processing of the data in accordance with the purposes b), c), e), g), h) 
and i) is the legitimate interest of Iberdrola in, respectively, (i) administering and properly 
organising its relations with suppliers, (ii) improving such relations and obtaining statistics in this 
respect, (iii) to maintain adequate internal management of the Group, (iv) to exercise its right 
to effective judicial protection of its rights of defence, (v) to guarantee the security of its 
computer networks and (vi) to maintain a record of contracts that will facilitate future processes 
of contracting with the supplier. 


The legal basis for the processing of your data for purposes (f) and (j) is to comply with legal 
obligations. 


The legal basis for the processing of the data for the purpose k) is the public interest and the 
legitimate interest of Iberdrola in the creation and maintenance of information systems through 
which the company can be informed of the commission, within the company or by third parties 


contracting with it, of acts that may be contrary to the applicable regulations or to the internal 
rules of Iberdrola, respectively. 


How long do we store your data? 


The personal data processed to fulfil the purposes a), b), d), e), f), g), h), j) and k) will be kept for 
the time necessary to fulfil the purpose for which they were collected and in any case until the 
end of the contractual relationship. The data may be kept subsequently, duly blocked, until the 
expiry of the limitation period of any obligations to which Iberdrola is subject and any liabilities 
arising from the processing of such data. 


The personal data processed for the purpose contained in point c) will be kept until the survey, 
statistics or report has been drawn up. 


The personal data collected to fulfil the purpose i), will be kept by Iberdrola after the end of the 
contract as long as the supplier's interest in being contracted by Iberdrola subsists and therefore 
does not oppose such processing. 


Who will receive your data? 


Your personal data (or the personal data of the representative or contact person in the case of 
legal entities) may be disclosed to third parties or public bodies when it is necessary for (i) the 
management, development and execution of the contractual relationship, including the 
fulfilment of our obligations or the exercise of our rights, (iii) if we are obliged to do so by virtue 
of a legal obligation or (iv) to comply with a judicial or administrative order from a competent 
authority. 


The data may be communicated to the companies of the Iberdrola Group that have an interest 
in contracting you. Such Iberdrola Group companies are those listed on the corporate website 
https://www.iberdrola.com/wcorp/gc/prod/es_ ES/corporativos/docs/IB_Informe Financiero 


Anual.pdf 


In this context, in the event that the communication of your personal data occurs to Iberdrola 
Group companies located outside the European Economic Area, in countries that do not offer 
an adequate level of protection of personal data equivalent to that established in the European 
Union, we inform you that such transfers will be made in accordance with applicable data 
protection laws and our binding corporate rules ("BCR"). Having BCRs in place means that all 
entities in our group that subscribe to them have to comply with the GDPR and the same internal 
rules. It also means that you have the same rights regardless of where Iberdrola processes your 
data. You can download a copy of the Iberdrola Group BCRs in www.iberdrola.com 


The data will be accessible by external service providers linked to the contractual relationship 
such as billing and payment services, administration of accounts payable, consulting and 
reporting services and IT services, with which we have entered into legally required contracts 
under which they guarantee the fulfilment of their obligations as data processors. In these 
contracts, when the companies are located in a third country that does not offer an adequate 
level of protection of personal data equivalent to that established in the European Union, 
Iberdrola will ensure that it has the appropriate measures in place so that your data is protected 
in the country and organization of destination in identical or similar terms to those provided for 
in European and Spanish regulations. You may contact Iberdrola at any time to learn about the 
specific guarantees that have been implemented for the adequate and appropriate protection 
of your data. 


What are your rights? 


You have the right of access to your personal data, as well as to request the rectification of 
inaccurate data or, where appropriate, to request its erasure when data is no longer necessary 
for the purposes for which it was collected, in addition to exercising the right to object and 
restrict the processing and data portability. 


You can exercise these rights by writing us at: dataprotection corporate@scottishpower.com 
or Data Protection Officer, Scottish Power UK Plc, 320 St Vincent Street, Glasgow, G2 5AD. 


You also have the right to file a complaint with the Information Commissioner’s Office if you are 
dissatisfied with the response provided by ScottishPower regarding the exercising of any of your 
rights. 


Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

SK9 5AF 


0303 123 1113 


